The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes natural language directives from potentially untrusted sources (user arguments or output from a /debug tool) and uses them to perform file edits and execute shell commands.
Ingestion points: The $ARGUMENTS variable in SKILL.md (Step 1: Parse Directive) is the primary entry point for untrusted instructions.
Boundary markers: The skill lacks explicit boundary markers or instructions to the LLM to ignore embedded commands within the fix directives.
Capability inventory: The skill utilizes powerful tools including Bash, Edit, Write, and Read, which could be abused if an injected directive targets system files or executes malicious shell scripts.
Sanitization: There is no evidence of sanitization or validation of the directive content before it is used to influence file modifications or verification commands.
[COMMAND_EXECUTION]: The skill performs dynamic command execution during its verification phase (Step 4: Verify).
Evidence: It reads and executes shell commands defined in a local configuration file (.fullstack-dev/config.json). If this file is modified by a malicious actor or an automated process, it could lead to arbitrary code execution in the developer's environment.
Evidence: The skill auto-detects and executes project build scripts (e.g., npm run build, npx tsc) based on the content of the repository, which is a standard but significant execution surface.

fix